5 ms·

Anyone know the current state of the industry? Large corporations are run by business majors who often have a disdain for computer science. Usually this leads

Anyone know the current state of the industry? Large corporations are run by business majors who often have a disdain for computer science. Usually this leads to not hiring the top security experts (either through lack of knowledge or not wanting anyone smarter than themselves at the wheel). I've personally seen this at a few jobs. It can go both ways as often CS-saavy startup founders are the same way towards business majors.

lotsofpulp 8y ago
I think it's mostly the fact that the cost of data breaches is less than the savings (i.e. profit) from not implementing rigorous systems.
- staplers 8y ago
  FREE and OSS CMS' encrypt customer data now.. Don't know where this myth that it costs money to do basic encryption is coming from..
  - myrion 8y ago
    The cost in this case would be in switching. They're already using a system that works for them, why bother changing to something else?
  - Kalium 8y ago
    You're absolutely right! The basic software infrastructure that can be adapted to safely and securely handle user data is completely free. It may be worth considering that adapting said FLOSS software, doing the requisite custom integration work, and then doing a large migration successfully might all be perhaps slightly less free than the software you correctly and wisely point to.
  - sbarre 8y ago
    Large enterprises have extremely complex and interconnected systems. The real costs and work is in the migration and adoption of new tools (regardless of the cost of the tools themselves).
  - EpicEng 8y ago
    It's not only the cost to encrypt something. It's the cost to create security policies, hire people who know the field, implement protections beyond encrypting data at rest, updating old software to deal with the new security measures, etc. It's never as simple as "just encrypt that field". Until there's a good reason to do so people aren't going to bother.
- barbecue_sauce 8y ago
  People don't seem to realize the financial planning aspect of deciding whether to do rigorous security or not. A major part of training materials for CISSP, which is really more of a security management certification than a technical one, is explicitly about doing a cost-benefit analysis of security implementation. See https://en.wikipedia.org/wiki/Annualized_loss_expectancy https://en.wikipedia.org/wiki/Annualized_loss_expectancy. That said, there are fair number of common-sense low or zero cost safeguards any technical employees could implement to help mitigate threats.
  - idontpost 8y ago
    > That said, there are fair number of common-sense low or zero cost safeguards any technical employees could implement to help mitigate threats. The cost isn't in the safeguards. The cost is in the governance structures (i.e. time spent by mid-level managers) that ensure the safeguards are followed and applied consistently across the organization. Encrypting database fields is basically free. Making sure all database fields that should be encrypted are is an expensive process.
- rosege 8y ago
  Your comment reminds me of this https://www.youtube.com/watch?v=SiB8GVMNJkE https://www.youtube.com/watch?v=SiB8GVMNJkE
  - neogodless 8y ago
    It's a little chilling, but I assumed the clip you linked was the one you did! I believe it was in one of Henry Cloud's books on boundaries where I learned the idea that people roughly fit into three categories. - they want to treat others well, and if you inform them of a boundary they've overstepped, they'll try to correct it - they care about themselves within the framework of our society and laws, but are not keen on giving up anything for anyone else. If you want to enforce a boundary with them, you have to find a way to shift the consequences of their actions back onto them. Only if it hurts them, will they change their behavior - they don't care about laws, society, decency, etc - you'll need guns and lawyers. Right now it feels like many corporations are on a wide line between the second and third description above... what a sad realization!
deleted 8y ago
[deleted]
diminoten 8y ago
Disdain? What the hell? I know more than my fair share of MBAs and they're all fascinated by my job, far as I can tell...
mr1976 8y ago
I worked for Marriott for a long time (on the tech side). They have no distain for computer science, it's not "run by business majors", and there is no shortage of security experts. They were one of the more on the ball technology and security operations _for a company of that age and size and legacy_. The company as a whole placed huge focus, resources and energy on information security from well before I joined - it was one of the most risk averse groups I've worked for. The incident took place on the Starwood network (they bought starwood, a completely separate company with completely separate infrastructure), and this issue was discovered post acquisition and during the long running integration program (starwood had 2 breaches previously, so I guess it's not surprising). From what I've seen, if it wasn't for the controls implemented as part of the integration which formed part of Marriott's standard risk-averse approach to security generally, it probably wouldn't have been found for another 4 years. It's complicated, and 99% of the "damn fool corporates and their evil ways!" comments are completely off the mark because they don't have the context. The reality is that integrating another business is unbelievable difficult. Managing the (now significantly higher) infosec risks more so. You inherit a landscape with monsters you don't know about, and you still have to own whatever pops out. It's a really, really bad thing to have happened - make no mistake. And in time, the full story will out and opinions can be reached based on facts. Maybe they did screw it up. Maybe they could have done stuff differently. I don't think it's like equifax with a clear cut cause and effect, but a reasonably complicated ecosystem steeped in legacy systems opaque dependencies that is really hard to change. It seems to be this generally accepted thing that whenever there is a huge breach, some people (aside from the person doing the breaching) have been utterly negligent, ignored all the obvious and really quite simple (I mean, just encryption all the things, amirite? duh!) and should be rounded up and shot at dawn. Perhaps - just perhaps - it's something that wasn't a result of negligence, and just wasn't foreseen because hard stuff is hard. Hindsight really does create the most impressive armchair strategists. (no, I don't still work there. I left a few years ago. no, I don't think they're perfect. no, I don't think all corporations are evil incarnate looking to steal our data, only some of them.)
eeeeeeeeeeeee 8y ago
I haven't seen any evidence of that. Those people respond to incentives and there are few current incentives to push companies to spend time on security, especially preemptively. Yes, there will be some public blowback if you're compromised, but that will blow over. Plus consumers are well aware that this is happening all the time to other companies, so it's become "normal" behavior now. The fines for neglect of personal customer data need to be so high that the boards of these companies and their shareholders demand that their executives make security a priority. HIPAA (https://compliancy-group.com/hipaa-fines-directory-year/ https://compliancy-group.com/hipaa-fines-directory-year/) is a decent model and it does seem like security is taken more seriously in the healthcare industry in general. That being said, the actual fines are relatively low when you look at the size of some of these companies. Anthem is one example: https://www.hhs.gov/about/news/2018/10/15/anthem-pays-ocr-16-million-record-hipaa-settlement-following-largest-health-data-breach-history.html https://www.hhs.gov/about/news/2018/10/15/anthem-pays-ocr-16... That was the largest HIPAA fine ever ($16 million) for a company that pulls in $90 BILLION in revenue each year and 79 million people had their information compromised in that event. That fine is basically a rounding error for them. Still, this outcome is better than what happens with most non-healthcare security compromises, which is basically nothing except "we're sorry, we take security seriously, and here is one year of credit monitoring."
- kerng 8y ago
  HIPPA is mostly self attestation, so it's one of the weaker compliance requirements actually. But you are correct that at least there is some fine involved. GDPR will be interesting to follow also, and to see how high the fines will go in the future.

lotsofpulp 8y ago

I think it's mostly the fact that the cost of data breaches is less than the savings (i.e. profit) from not implementing rigorous systems.

staplers 8y ago
FREE and OSS CMS' encrypt customer data now.. Don't know where this myth that it costs money to do basic encryption is coming from..
- myrion 8y ago
  The cost in this case would be in switching. They're already using a system that works for them, why bother changing to something else?
- Kalium 8y ago
  You're absolutely right! The basic software infrastructure that can be adapted to safely and securely handle user data is completely free. It may be worth considering that adapting said FLOSS software, doing the requisite custom integration work, and then doing a large migration successfully might all be perhaps slightly less free than the software you correctly and wisely point to.
- sbarre 8y ago
  Large enterprises have extremely complex and interconnected systems. The real costs and work is in the migration and adoption of new tools (regardless of the cost of the tools themselves).
- EpicEng 8y ago
  It's not only the cost to encrypt something. It's the cost to create security policies, hire people who know the field, implement protections beyond encrypting data at rest, updating old software to deal with the new security measures, etc. It's never as simple as "just encrypt that field". Until there's a good reason to do so people aren't going to bother.
barbecue_sauce 8y ago
People don't seem to realize the financial planning aspect of deciding whether to do rigorous security or not. A major part of training materials for CISSP, which is really more of a security management certification than a technical one, is explicitly about doing a cost-benefit analysis of security implementation. See https://en.wikipedia.org/wiki/Annualized_loss_expectancy https://en.wikipedia.org/wiki/Annualized_loss_expectancy. That said, there are fair number of common-sense low or zero cost safeguards any technical employees could implement to help mitigate threats.
- idontpost 8y ago
  > That said, there are fair number of common-sense low or zero cost safeguards any technical employees could implement to help mitigate threats. The cost isn't in the safeguards. The cost is in the governance structures (i.e. time spent by mid-level managers) that ensure the safeguards are followed and applied consistently across the organization. Encrypting database fields is basically free. Making sure all database fields that should be encrypted are is an expensive process.
rosege 8y ago
Your comment reminds me of this https://www.youtube.com/watch?v=SiB8GVMNJkE https://www.youtube.com/watch?v=SiB8GVMNJkE
- neogodless 8y ago
  It's a little chilling, but I assumed the clip you linked was the one you did! I believe it was in one of Henry Cloud's books on boundaries where I learned the idea that people roughly fit into three categories. - they want to treat others well, and if you inform them of a boundary they've overstepped, they'll try to correct it - they care about themselves within the framework of our society and laws, but are not keen on giving up anything for anyone else. If you want to enforce a boundary with them, you have to find a way to shift the consequences of their actions back onto them. Only if it hurts them, will they change their behavior - they don't care about laws, society, decency, etc - you'll need guns and lawyers. Right now it feels like many corporations are on a wide line between the second and third description above... what a sad realization!

deleted 8y ago

[deleted]

diminoten 8y ago

Disdain? What the hell? I know more than my fair share of MBAs and they're all fascinated by my job, far as I can tell...

mr1976 8y ago

I worked for Marriott for a long time (on the tech side). They have no distain for computer science, it's not "run by business majors", and there is no shortage of security experts. They were one of the more on the ball technology and security operations _for a company of that age and size and legacy_. The company as a whole placed huge focus, resources and energy on information security from well before I joined - it was one of the most risk averse groups I've worked for. The incident took place on the Starwood network (they bought starwood, a completely separate company with completely separate infrastructure), and this issue was discovered post acquisition and during the long running integration program (starwood had 2 breaches previously, so I guess it's not surprising). From what I've seen, if it wasn't for the controls implemented as part of the integration which formed part of Marriott's standard risk-averse approach to security generally, it probably wouldn't have been found for another 4 years. It's complicated, and 99% of the "damn fool corporates and their evil ways!" comments are completely off the mark because they don't have the context. The reality is that integrating another business is unbelievable difficult. Managing the (now significantly higher) infosec risks more so. You inherit a landscape with monsters you don't know about, and you still have to own whatever pops out. It's a really, really bad thing to have happened - make no mistake. And in time, the full story will out and opinions can be reached based on facts. Maybe they did screw it up. Maybe they could have done stuff differently. I don't think it's like equifax with a clear cut cause and effect, but a reasonably complicated ecosystem steeped in legacy systems opaque dependencies that is really hard to change. It seems to be this generally accepted thing that whenever there is a huge breach, some people (aside from the person doing the breaching) have been utterly negligent, ignored all the obvious and really quite simple (I mean, just encryption all the things, amirite? duh!) and should be rounded up and shot at dawn. Perhaps - just perhaps - it's something that wasn't a result of negligence, and just wasn't foreseen because hard stuff is hard. Hindsight really does create the most impressive armchair strategists. (no, I don't still work there. I left a few years ago. no, I don't think they're perfect. no, I don't think all corporations are evil incarnate looking to steal our data, only some of them.)

eeeeeeeeeeeee 8y ago

I haven't seen any evidence of that. Those people respond to incentives and there are few current incentives to push companies to spend time on security, especially preemptively. Yes, there will be some public blowback if you're compromised, but that will blow over. Plus consumers are well aware that this is happening all the time to other companies, so it's become "normal" behavior now. The fines for neglect of personal customer data need to be so high that the boards of these companies and their shareholders demand that their executives make security a priority. HIPAA (https://compliancy-group.com/hipaa-fines-directory-year/ https://compliancy-group.com/hipaa-fines-directory-year/) is a decent model and it does seem like security is taken more seriously in the healthcare industry in general. That being said, the actual fines are relatively low when you look at the size of some of these companies. Anthem is one example: https://www.hhs.gov/about/news/2018/10/15/anthem-pays-ocr-16-million-record-hipaa-settlement-following-largest-health-data-breach-history.html https://www.hhs.gov/about/news/2018/10/15/anthem-pays-ocr-16... That was the largest HIPAA fine ever ($16 million) for a company that pulls in $90 BILLION in revenue each year and 79 million people had their information compromised in that event. That fine is basically a rounding error for them. Still, this outcome is better than what happens with most non-healthcare security compromises, which is basically nothing except "we're sorry, we take security seriously, and here is one year of credit monitoring."

kerng 8y ago
HIPPA is mostly self attestation, so it's one of the weaker compliance requirements actually. But you are correct that at least there is some fine involved. GDPR will be interesting to follow also, and to see how high the fines will go in the future.